chore(deps): bump payload from 3.55.1 to 3.74.0

[dependabot]

Bumps payload from 3.55.1 to 3.74.0.

Release notes

Sourced from payload's releases.

v3.74.0

v3.74.0 (2026-01-30)

🚀 Features

• thread override access in doc level hooks (#15421) (85d5263)
• extend strictDraftTypes to all draft operations (#15292) (9239164)
• add support for custom UnpublishButton component (#15400) (94254da)
• storage-r2: client uploads using R2 multipart api (#14733) (5c38902)
• ui: allows opting out of popup closing logic (#15407) (fb2b602)
• ui: allows customizing Popup component portal className (#15406) (0f55464)

---

Override Access in Document-Level Hooks - Access the overrideAccess value inside collection and global hooks. Useful when hook logic needs to know whether access control was bypassed, such as when querying related documents up a hierarchy. #15421

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeChange: [
      ({ overrideAccess, req }) => {
        if (overrideAccess) {
          // Access control was bypassed
        }
      },
    ],
  },
}

---

Extended strictDraftTypes to All Operations - When strictDraftTypes: true is enabled, TypeScript now enforces draft type safety across all Local API operations (not just queries). The draft option is forbidden for collections/globals without drafts enabled, preventing silent runtime behavior where draft flags are ignored. #15292

import { buildConfig } from 'payload'
export default buildConfig({
typescript: {
strictDraftTypes: true, // Enables compile-time draft enforcement
},
// ...
})

⚠️ Note: Generic collection slugs may require explicit type assertions when using draft options.

---

... (truncated)

Commits

• de4fa0c chore(release): v3.74.0 [skip ci]
• 2dc2e7c fix: isolate payload-preferences by auth collection (#15425)
• 85d5263 feat: thread override access in doc level hooks (#15421)
• 9239164 feat: extend strictDraftTypes to all draft operations (#15292)
• 6b45fee chore: export getSafeFileName utility (#15424)
• 94254da feat: add support for custom UnpublishButton component (#15400)
• 99b051e fix: traverseFields returning wrong parentPath dot notation for non-localised...
• 5561799 fix: widgets and other features failing with transitive dependency imports (#...
• 7043e3f chore(deps): bump tsx (#15363)
• 2511c02 fix: replace deprecated scmp with crypto.timingSafeEqual (#15322)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.